
<!DOCTYPE html>
<html lang="" class="loading">
<head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
    <meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no">
    <title>BUU_WP - L3SLIE</title>
    <meta name="apple-mobile-web-app-capable" content="yes" />
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <meta name="google" content="notranslate" />
    <meta name="keywords" content="L3SLIE,"> 
    <meta name="description" content="Welcome &amp; suit yourself,因为学校项目，鸽了好多天，现在重新开始刷题
gugubird
[FlareOn4]IgniteMevoid __noreturn start()
{
  DWORD NumberOfBytesWri,"> 
    <meta name="author" content="L3SLIE"> 
    <link rel="alternative" href="atom.xml" title="L3SLIE" type="application/atom+xml"> 
    <link rel="icon" href="/img/favicon.png"> 
    <link href="https://fonts.loli.net/css?family=Roboto+Mono|Rubik&display=swap" rel="stylesheet">
    
<link rel="stylesheet" href="//at.alicdn.com/t/font_1429596_nzgqgvnmkjb.css">

    
<link rel="stylesheet" href="//cdn.bootcss.com/animate.css/3.7.2/animate.min.css">

    
<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/social-share.js/1.0.16/css/share.min.css">

    
<link rel="stylesheet" href="//cdn.bootcss.com/codemirror/5.48.4/codemirror.min.css">

    
<link rel="stylesheet" href="//cdn.bootcss.com/codemirror/5.48.4/theme/dracula.css">

    
<link rel="stylesheet" href="/css/obsidian.css">

    
<link rel="stylesheet" href="/css/ball-atom.min.css">

<meta name="generator" content="Hexo 4.2.0"></head>


<body class="loading">
    <div class="loader">
        <div class="la-ball-atom la-2x">
            <div></div>
            <div></div>
            <div></div>
            <div></div>
        </div>
    </div>
    <span id="config-title" style="display:none">L3SLIE</span>
    <div id="loader"></div>
    <div id="single">
    <div class="scrollbar gradient-bg-rev"></div>
<div id="top" style="display: block;">
    <div class="bar" style="width: 0;"></div>
    <div class="navigation animated fadeIn fast delay-1s">
        <img id="home-icon" class="icon-home" src="/img/favicon.png" alt="" data-url="http://l3slie.gitee.io">
        <div id="play-icon" title="Play/Pause" class="iconfont icon-play"></div>
        <h3 class="subtitle">BUU_WP</h3>
        <div class="social">
            <!--        <div class="like-icon">-->
            <!--            <a href="javascript:;" class="likeThis active"><span class="icon-like"></span><span class="count">76</span></a>-->
            <!--        </div>-->
            <div>
                <div class="share">
                    
                        <a href="javascript:;" class="iconfont icon-share1"></a>
                        <div class="share-component-cc" data-disabled="facebook,douban,linkedin,diandian,tencent,google"></div>
                    
                </div>
            </div>
        </div>
    </div>
</div>

    <div class="section">
        <div class=article-header-wrapper>
    <div class="article-header">
        <div class="article-cover animated fadeIn" style="
            animation-delay: 600ms;
            animation-duration: 1.2s;
            background-image: 
                radial-gradient(ellipse closest-side, rgba(0, 0, 0, 0.65), #100e17),
                url(/img/cover2.jpg) ">
        </div>
        <div class="else">
            <p class="animated fadeInDown">
                
                <a href="/categories/BUUOJ"><b>「
                    </b>BUUOJ<b> 」</b></a>
                
                August 22, 2020
            </p>
            <h3 class="post-title animated fadeInDown"><a href="/2020/08/22/BUU-WP-0/" title="BUU_WP" class="">BUU_WP</a>
            </h3>
            
            <p class="post-count animated fadeInDown">
                
                <span>
                    <b class="iconfont icon-text2"></b> <i>Words count</i>
                    17k
                </span>
                
                
                <span>
                    <b class="iconfont icon-timer__s"></b> <i>Reading time</i>
                    15 mins.
                </span>
                
                
                <span id="/2020/08/22/BUU-WP-0/" class="leancloud_visitors" data-flag-title="BUU_WP">
                    <b class="iconfont icon-read"></b> <i>Read count</i>
                    <span class="leancloud-visitors-count">100000</span>
                </span>
                
                
            </p>
            
            
            <ul class="animated fadeInDown post-tags-list" itemprop="keywords"><li class="animated fadeInDown post-tags-list-item"><a class="animated fadeInDown post-tags-list-link" href="/tags/CTF/" rel="tag">CTF</a></li><li class="animated fadeInDown post-tags-list-item"><a class="animated fadeInDown post-tags-list-link" href="/tags/WP/" rel="tag">WP</a></li></ul>
            
        </div>
    </div>
</div>

<div class="screen-gradient-after">
    <div class="screen-gradient-content">
        <div class="screen-gradient-content-inside">
            <div class="bold-underline-links screen-gradient-sponsor">
                <p>
                    <span class="animated fadeIn delay-1s"></span>
                </p>
            </div>
        </div>
    </div>
</div>

<div class="article">
    <div class='main'>
        <div class="content markdown animated fadeIn">
            <p>因为学校项目，鸽了好多天，现在重新开始刷题</p>
<p>gugubird</p>
<h1 id="FlareOn4-IgniteMe"><a href="#FlareOn4-IgniteMe" class="headerlink" title="[FlareOn4]IgniteMe"></a>[FlareOn4]IgniteMe</h1><pre><code class="c">void __noreturn start()
{
  DWORD NumberOfBytesWritten; // [esp+0h] [ebp-4h]

  NumberOfBytesWritten = 0;
  hFile = GetStdHandle(0xFFFFFFF6);
  dword_403074 = GetStdHandle(0xFFFFFFF5);
  WriteFile(dword_403074, aG1v3M3T3hFl4g, 0x13u, &amp;NumberOfBytesWritten, 0);
  sub_4010F0(NumberOfBytesWritten);
  if ( sub_401050() )
    WriteFile(dword_403074, aG00dJ0b, 0xAu, &amp;NumberOfBytesWritten, 0);
  else
    WriteFile(dword_403074, aN0tT00H0tRWe7r, 0x24u, &amp;NumberOfBytesWritten, 0);
  ExitProcess(0);
}</code></pre>
<p>主要逻辑在<code>sub_4010F0</code>和<code>sub_401050</code>里</p>
<h2 id="sub-4010F0"><a href="#sub-4010F0" class="headerlink" title="sub_4010F0"></a>sub_4010F0</h2><pre><code class="c">signed int sub_4010F0()
{
  unsigned int v0; // eax
  char Buffer[260]; // [esp+0h] [ebp-110h]
  DWORD NumberOfBytesRead; // [esp+104h] [ebp-Ch]
  unsigned int i; // [esp+108h] [ebp-8h]
  char v5; // [esp+10Fh] [ebp-1h]

  v5 = 0;
  for ( i = 0; i &lt; 0x104; ++i )
    Buffer[i] = 0;
  ReadFile(hFile, Buffer, 0x104u, &amp;NumberOfBytesRead, 0);
  for ( i = 0; ; ++i )
  {
    v0 = sub_401020((int)Buffer);
    if ( i &gt;= v0 )
      break;
    v5 = Buffer[i];
    if ( v5 != &#39;\n&#39; &amp;&amp; v5 != &#39;\r&#39; )
    {
      if ( v5 )
        byte_403078[i] = v5;
    }
  }
  return 1;
}</code></pre>
<h2 id="sub-401050"><a href="#sub-401050" class="headerlink" title="sub_401050"></a>sub_401050</h2><pre><code class="c">signed int sub_401050()
{
  int v0; // ST04_4
  int i; // [esp+4h] [ebp-8h]
  unsigned int j; // [esp+4h] [ebp-8h]
  char v4; // [esp+Bh] [ebp-1h]

  v0 = sub_401020((int)byte_403078);
  v4 = sub_401000();
  for ( i = v0 - 1; i &gt;= 0; --i )
  {
    byte_403180[i] = v4 ^ byte_403078[i];
    v4 = byte_403078[i];
  }
  for ( j = 0; j &lt; 39; ++j )
  {
    if ( byte_403180[j] != (unsigned __int8)byte_403000[j] )
      return 0;
  }
  return 1;
}</code></pre>
<p>sub_401050函数就是将字符串逆向做了异或操作之后，与已知字符串byte_403000对比。</p>
<p>sub_4010F0函数就是把我们输入字符串中的<code>/r/n</code>去掉。</p>
<h2 id="exp"><a href="#exp" class="headerlink" title="exp"></a>exp</h2><pre><code class="python"># -*- coding:utf-8 -*-

arr2 = [0x0D,0x26,0x49,0x45,0x2A,0x17,0x78,0x44,0x2B,0x6C,0x5D,0x5E,0x45,0x12,0x2F,0x17,
0x2B,0x44,0x6F,0x6E,0x56,0x09,0x5F,0x45,0x47,0x73,0x26,0x0A,0x0D,0x13,0x17,0x48,
0x42,0x01,0x40,0x4D,0x0C,0x02,0x69]

arr1 = []
v4 = 4
for i in range(len(arr2)-1,-1,-1):
    arr1.append(arr2[i] ^ v4)
    v4 = arr1[-1]
print (&#39;flag{&#39;+&#39;&#39;.join([chr(x) for x in arr1[::-1]])+&#39;}&#39;)</code></pre>
<hr>
<h1 id="HDCTF2019-Maze"><a href="#HDCTF2019-Maze" class="headerlink" title="[HDCTF2019]Maze"></a>[HDCTF2019]Maze</h1><h1 id="脱壳"><a href="#脱壳" class="headerlink" title="脱壳"></a>脱壳</h1><p>upx壳，放脱壳机直接脱</p>
<h2 id="迷宫"><a href="#迷宫" class="headerlink" title="迷宫"></a>迷宫</h2><pre><code class="c">*******+********* ******    ****   ******* **F******    **************</code></pre>
<p>脱壳后发现0x40102E有莫名的指令，使用OD nop掉，转存到新文件。</p>
<p>再次使用ida打开</p>
<pre><code class="c">int __cdecl main(int argc, const char **argv, const char **envp)
{
  signed int i; // [esp+10h] [ebp-14h]
  char v5[16]; // [esp+14h] [ebp-10h]

  sub_401140(aGoThroughTheMa);
  scanf(a14s, v5);
  for ( i = 0; i &lt;= 13; ++i )
  {
    switch ( v5[i] )
    {
      case &#39;a&#39;:
        --dword_408078;                         // 初始7
        break;
      case &#39;d&#39;:
        ++dword_408078;
        break;
      case &#39;s&#39;:
        --dword_40807C;                         // 初始0
        break;
      case &#39;w&#39;:
        ++dword_40807C;
        break;
      default:
        continue;
    }
  }
  if ( dword_408078 != 5 || dword_40807C != -4 )
  {
    sub_401140(aTryAgain);
  }
  else
  {
    sub_401140(aCongratulation);
    sub_401140(aHereIsTheFlagF);
  }
  return 0;
}</code></pre>
<p>通过初始值和迷宫字符串可大致推断出迷宫，走的方法就是wasd上下左右</p>
<pre><code class="text">*******+**
******* **
****    **
**   *****
** **F****
**    ****
**********</code></pre>
<p>走出来就是flag</p>
<h2 id="flag"><a href="#flag" class="headerlink" title="flag"></a>flag</h2><blockquote>
<p><strong>flag{ssaaasaassdddw}</strong></p>
</blockquote>
<hr>
<p><del>——————-                        ———分鸽线————                  ———————-</del></p>
<h1 id="RoarCTF2019-babyRSA"><a href="#RoarCTF2019-babyRSA" class="headerlink" title="[RoarCTF2019]babyRSA"></a>[RoarCTF2019]babyRSA</h1><h2 id="题目"><a href="#题目" class="headerlink" title="题目"></a>题目</h2><pre><code class="python">import sympy
import random

def myGetPrime():
    A= getPrime(513)
    print(A)
    B=A-random.randint(1e3,1e5)
    print(B)
    return sympy.nextPrime((B!)%A)
p=myGetPrime()
#A1=21856963452461630437348278434191434000066076750419027493852463513469865262064340836613831066602300959772632397773487317560339056658299954464169264467234407
#B1=21856963452461630437348278434191434000066076750419027493852463513469865262064340836613831066602300959772632397773487317560339056658299954464169264467140596

q=myGetPrime()
#A2=16466113115839228119767887899308820025749260933863446888224167169857612178664139545726340867406790754560227516013796269941438076818194617030304851858418927
#B2=16466113115839228119767887899308820025749260933863446888224167169857612178664139545726340867406790754560227516013796269941438076818194617030304851858351026

r=myGetPrime()

n=p*q*r
#n=85492663786275292159831603391083876175149354309327673008716627650718160585639723100793347534649628330416631255660901307533909900431413447524262332232659153047067908693481947121069070451562822417357656432171870951184673132554213690123308042697361969986360375060954702920656364144154145812838558365334172935931441424096270206140691814662318562696925767991937369782627908408239087358033165410020690152067715711112732252038588432896758405898709010342467882264362733
c=pow(flag,e,n)
#e=0x1001
#c=75700883021669577739329316795450706204502635802310731477156998834710820770245219468703245302009998932067080383977560299708060476222089630209972629755965140317526034680452483360917378812244365884527186056341888615564335560765053550155758362271622330017433403027261127561225585912484777829588501213961110690451987625502701331485141639684356427316905122995759825241133872734362716041819819948645662803292418802204430874521342108413623635150475963121220095236776428
#so,what is the flag?
</code></pre>
<p>这个题当时打比赛是就没做出来，好菜。。。</p>
<p>现在再复现一遍</p>
<p>关键点在<code>return sympy.nextPrime((B!)%A)</code>这里</p>
<p>题中给出了得到p，q的A1，A2，B1，B2</p>
<p>也就是</p>
<pre><code class="python">p=(B1!)%A1
q=(B2!)%A2</code></pre>
<h2 id="扩充：Wilson定理"><a href="#扩充：Wilson定理" class="headerlink" title="扩充：Wilson定理"></a>扩充：Wilson定理</h2><p><code>当且仅当p为素数时：( p -1 )! ≡ -1 ( mod p )</code></p>
<p>而B=A-random.randint(1e3,1e5)，所以在B前补上</p>
<pre><code class="txt">(A−1)(A−2)(A−3)...(B+1)

(A−1)(A−2)(A−3)...(B+1)∗(B!)%A=−1%A

(A−2)(A−3)...(B+1)∗(B!)%A=1%A</code></pre>
<p>这就意味这可由(A−2)(A−3)…(B+1)(A−2)(A−3)…(B+1)模A的逆元求得(B!)%A(B!)%A的值。再取nextprime(注：sympy.ntheory.generate模块里的nextprime不是nextPrime)即可得到p或q的值。</p>
<h2 id="exp-1"><a href="#exp-1" class="headerlink" title="exp"></a>exp</h2><pre><code class="python">from sympy import nextprime
from Crypto.Util.number import *
from gmpy2 import invert

def get_p_q(A,B):
    tmp = 1
    # calculate remain value (mod A) of (A−1)(A−2)(A−3)...(B+1)
    for i in range(B+1,A-1):
        tmp *= i
        tmp %= A

    tmp_inv = invert(tmp,A)
    result = nextprime(tmp_inv)
    return result

A1=21856963452461630437348278434191434000066076750419027493852463513469865262064340836613831066602300959772632397773487317560339056658299954464169264467234407
B1=21856963452461630437348278434191434000066076750419027493852463513469865262064340836613831066602300959772632397773487317560339056658299954464169264467140596

A2=16466113115839228119767887899308820025749260933863446888224167169857612178664139545726340867406790754560227516013796269941438076818194617030304851858418927
B2=16466113115839228119767887899308820025749260933863446888224167169857612178664139545726340867406790754560227516013796269941438076818194617030304851858351026

n=85492663786275292159831603391083876175149354309327673008716627650718160585639723100793347534649628330416631255660901307533909900431413447524262332232659153047067908693481947121069070451562822417357656432171870951184673132554213690123308042697361969986360375060954702920656364144154145812838558365334172935931441424096270206140691814662318562696925767991937369782627908408239087358033165410020690152067715711112732252038588432896758405898709010342467882264362733
e=0x1001
c=75700883021669577739329316795450706204502635802310731477156998834710820770245219468703245302009998932067080383977560299708060476222089630209972629755965140317526034680452483360917378812244365884527186056341888615564335560765053550155758362271622330017433403027261127561225585912484777829588501213961110690451987625502701331485141639684356427316905122995759825241133872734362716041819819948645662803292418802204430874521342108413623635150475963121220095236776428

p = get_p_q(A1,B1)
q = get_p_q(A2,B2)
print(p)
print(q)
# p = 1276519424397216455160791032620569392845781005616561979809403385593761615670426423039762716291920053306063214548359656555809123127361539475238435285654851
# q = 13242175493583584108411324143773780862426183382017753129633978933213674770487765387985282956574197274056162861584407275172775868763712231230219112670015751

r = n // p // q
print(r)
# r = 5057572094237208127867754008134739503717927865750318894982404287656747895573075881186030840558129423864679886646066477437020450654848839861455661385205433

phn = (p - 1) * (q - 1) * (r - 1)
d = invert(e, phn)
print(d)
# d = 23245991568931089935575398139533179902151911325504278186895368123724684132878362590745372016987963378102056924287587028702166372731411906405181410326380814220943063812165970658883369631308421395770179828382024820676516261188276456737434776404340381374859304944884947772697915445301641449023374627214573292539161320959779418043275889202421521069705878414823578781441160766914068377017428380775625886023385019623499784980822629415795884228504498888092721097658433
m = pow(c,d,n)
print(m)
# 49562188096458630410563044417358818341913265571373725266976612126526106528404944745044614126232074073813936259453
print(long_to_bytes(m))</code></pre>
<hr>
<h1 id="WUSTCTF2020-B-se"><a href="#WUSTCTF2020-B-se" class="headerlink" title="[WUSTCTF2020]B@se"></a>[WUSTCTF2020]B@se</h1><h2 id="题目-1"><a href="#题目-1" class="headerlink" title="题目"></a>题目</h2><pre><code class="txt">密文：MyLkTaP3FaA7KOWjTmKkVjWjVzKjdeNvTnAjoH9iZOIvTeHbvD==
JASGBWcQPRXEFLbCDIlmnHUVKTYZdMovwipatNOefghq56rs****kxyz012789+/

oh holy shit, something is missing...</code></pre>
<p>变表base，但是表里有四个元素缺失，所以需要爆破这个四个元素的排列，先看看缺失的元素</p>
<pre><code class="python">import string
s = &quot;JASGBWcQPRXEFLbCDIlmnHUVKTYZdMovwipatNOefghq56rs****kxyz012789+/&quot;
for i in string.ascii_letters + string.digits:
    if(i not in s):
        print (i,end=&#39;&#39;)
#ju34</code></pre>
<p>看起来就是base64表的顺序打乱了，在网上找一个base64加密解密脚本改一下就可以了</p>
<h2 id="exp-2"><a href="#exp-2" class="headerlink" title="exp"></a>exp</h2><pre><code class="python">from Crypto.Util.number import *
from gmpy2 import *
from functools import reduce
import sympy
import itertools
#JASGBWcQPRXEFLbCDIlmnHUVKTYZdMovwipatNOefghq56rs****kxyz012789+/
# coding:utf-8
def My_base64_encode(inputs,s):
    bin_str = []
    for i in inputs:
        x = str(bin(ord(i))).replace(&#39;0b&#39;, &#39;&#39;)
        bin_str.append(&#39;{:0&gt;8}&#39;.format(x))
    #print(bin_str)
    outputs = &quot;&quot;
    nums = 0
    while bin_str:
        temp_list = bin_str[:3]
        if(len(temp_list) != 3):
            nums = 3 - len(temp_list)
            while len(temp_list) &lt; 3:
                temp_list += [&#39;0&#39; * 8]
        temp_str = &quot;&quot;.join(temp_list)
        #print(temp_str)
        temp_str_list = []
        for i in range(0,4):
            temp_str_list.append(int(temp_str[i*6:(i+1)*6],2))
        #print(temp_str_list)
        if nums:
            temp_str_list = temp_str_list[0:4 - nums]

        for i in temp_str_list:
            outputs += s[i]
        bin_str = bin_str[3:]
    outputs += nums * &#39;=&#39;
    print(&quot;Encrypted String:\n%s &quot;%outputs)

def My_base64_decode(inputs,s):
    bin_str = []
    for i in inputs:
        if i != &#39;=&#39;:
            x = str(bin(s.index(i))).replace(&#39;0b&#39;, &#39;&#39;)
            bin_str.append(&#39;{:0&gt;6}&#39;.format(x))
    #print(bin_str)
    outputs = &quot;&quot;
    nums = inputs.count(&#39;=&#39;)
    while bin_str:
        temp_list = bin_str[:4]
        temp_str = &quot;&quot;.join(temp_list)
        #print(temp_str)
        if(len(temp_str) % 8 != 0):
            temp_str = temp_str[0:-1 * nums * 2]
        for i in range(0,int(len(temp_str) / 8)):
            outputs += chr(int(temp_str[i*8:(i+1)*8],2))
        bin_str = bin_str[4:]    
    print(&quot;Decrypted String:\n%s &quot;%outputs)
#s = &quot;ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/&quot;
h=[&#39;j&#39;,&#39;u&#39;,&#39;3&#39;,&#39;4&#39;]
h1=list(itertools.permutations(h,4))
for i in h1:
    m=&quot;&quot;.join(i)
    s = &quot;JASGBWcQPRXEFLbCDIlmnHUVKTYZdMovwipatNOefghq56rs&quot;+m+&quot;kxyz012789+/&quot;
    input_str=&quot;MyLkTaP3FaA7KOWjTmKkVjWjVzKjdeNvTnAjoH9iZOIvTeHbvD==&quot;
#My_base64_encode(input_str)
    My_base64_decode(input_str,s)
#wctf2020{base64_1s_v3ry_e@sy_and_fuN} </code></pre>
<h1 id="WUSTCTF2020-dp-leaking-1s-very-d-angerous"><a href="#WUSTCTF2020-dp-leaking-1s-very-d-angerous" class="headerlink" title="[WUSTCTF2020]dp_leaking_1s_very_d@angerous"></a>[WUSTCTF2020]dp_leaking_1s_very_d@angerous</h1><p>首先了解一下<code>dp和dq</code></p>
<pre><code class="python">dp=d%(p-1)
dq=d%(q-1)</code></pre>
<p>这种参数是为了让解密的时候更快速产生的</p>
<h2 id="样例"><a href="#样例" class="headerlink" title="样例"></a>样例</h2><p>如果题目给出<code>p,q,dp,dq,c</code>，即不给出公钥<code>e</code>。</p>
<pre><code class="python">(&#39;p=&#39;, &#39;0xf85d730bbf09033a75379e58a8465f8048b8516f8105ce2879ce774241305b6eb4ea506b61eb7e376d4fcd425c76e80cb748ebfaf3a852b5cf3119f028cc5971L&#39;)
(&#39;q=&#39;, &#39;0xc1f34b4f826f91c5d68c5751c9af830bc770467a68699991be6e847c29c13170110ccd5e855710950abab2694b6ac730141152758acbeca0c5a51889cbe84d57L&#39;)
(&#39;dp=&#39;, &#39;0xf7b885a246a59fa1b3fe88a2971cb1ee8b19c4a7f9c1a791b9845471320220803854a967a1a03820e297c0fc1aabc2e1c40228d50228766ebebc93c97577f511&#39;)
(&#39;dq=&#39;, &#39;0x865fe807b8595067ff93d053cc269be6a75134a34e800b741cba39744501a31cffd31cdea6078267a0bd652aeaa39a49c73d9121fafdfa7e1131a764a12fdb95&#39;)
(&#39;c=&#39;, &#39;0xae05e0c34e2ba4ca3536987cc2cfc3f1f7f53190164d0ac50b44832f0e7224c6fdeebd2c91e3991e7d179c26b1b997295dc9724925ba431f527fba212703a0d14a34ce133661ae0b6001ee326303d6ccdc27dbd94e0987fae25a84f197c1535bdac9094bfb3846b7ca696b2e5082bea7bff804da275772ca05dd51b185a4fc30L&#39;)
</code></pre>
<p>解密</p>
<pre><code class="python">InvQ=gmpy2.invert(q,p)
mp=pow(c,dp,p)
mq=pow(c,dq,q)
m=(((mp-mq)*InvQ)%p)*q+mq
print &#39;{:x}&#39;.format(m).decode(&#39;hex&#39;)</code></pre>
<p>如果只有<code>dp或dq</code>泄露，可根据加密原理推导出d，然后可进行求解。</p>
<h2 id="exp-3"><a href="#exp-3" class="headerlink" title="exp"></a>exp</h2><pre><code class="python">import gmpy2
from Crypto.Util.number import *
# getd() 方法求私钥d
def getd(n,e,dp):
    for i in range(1,e):
        if (dp*e-1)%i == 0:
            if n%(((dp*e-1)//i)+1)==0:
                p=((dp*e-1)//i)+1
                q=n//(((dp*e-1)//i)+1)
                phi = (p-1)*(q-1)
                d = gmpy2.invert(e,phi)%phi
                return d

e = 65537
n = 156808343598578774957375696815188980682166740609302831099696492068246337198792510898818496239166339015207305102101431634283168544492984586566799996471150252382144148257236707247267506165670877506370253127695314163987084076462560095456635833650720606337852199362362120808707925913897956527780930423574343287847
c = 108542078809057774666748066235473292495343753790443966020636060807418393737258696352569345621488958094856305865603100885838672591764072157183336139243588435583104423268921439473113244493821692560960443688048994557463526099985303667243623711454841573922233051289561865599722004107134302070301237345400354257869
dp = 734763139918837027274765680404546851353356952885439663987181004382601658386317353877499122276686150509151221546249750373865024485652349719427182780275825

d=getd(n,e,dp)
m=pow(c,d,n)
print (long_to_bytes(m))</code></pre>

            <!--[if lt IE 9]><script>document.createElement('audio');</script><![endif]-->
            <audio id="audio" loop="1" preload="auto" controls="controls"
                data-autoplay="false">
                <source type="audio/mpeg" src="">
            </audio>
            
            <ul id="audio-list" style="display:none">
                
                
                <li title='0' data-url='/statics/i saw you in a dream.mp3'></li>
                
                    
            </ul>
            
            
            
            <div id="vcomments"></div>
            
        </div>
        <div class="sidebar">
            <div class="box animated fadeInRight">
                <div class="subbox">
                    <img src="/img/avatar.jpg" height=300 width=300></img>
                    <p>L3SLIE</p>
                    <span>Life Long & Pwn</span>
                    <dl>
                        <dd><a href="https://github.com/13slie" target="_blank"><span
                                    class=" iconfont icon-github"></span></a></dd>
                        <dd><a href="" target="_blank"><span
                                    class=" iconfont icon-twitter"></span></a></dd>
                        <dd><a href="https://stackexchange.com/users/17805607/l3slie" target="_blank"><span
                                    class=" iconfont icon-stack-overflow"></span></a></dd>
                    </dl>
                </div>
                <ul>
                    <li><a href="/">46 <p>Articles</p></a></li>
                    <li><a href="/categories">13 <p>Categories</p></a></li>
                    <li><a href="/tags">20 <p>Tags</p></a></li>
                    <br><span><b><p>友链博客</p></b></span><br>
                    <span><u><p><a href="http://rdd.xjusec.club/" target="_blank">Rdd</a></p></u></span>
                    <span><u><p><a href="http://www.xjusec.club/" target="_blank">XJUSEC</a></p></u></span>
                    <span><u><p><a href="http://www.r1ght0us.xyz/" target="_blank">r1ght0us</a></p></u></span>
                </ul>
            </div>
            
            
            
            <div class="box sticky animated fadeInRight faster">
                <div id="toc" class="subbox">
                    <h4>Contents</h4>
                    <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#FlareOn4-IgniteMe"><span class="toc-number">1.</span> <span class="toc-text">[FlareOn4]IgniteMe</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#sub-4010F0"><span class="toc-number">1.1.</span> <span class="toc-text">sub_4010F0</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#sub-401050"><span class="toc-number">1.2.</span> <span class="toc-text">sub_401050</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#exp"><span class="toc-number">1.3.</span> <span class="toc-text">exp</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#HDCTF2019-Maze"><span class="toc-number">2.</span> <span class="toc-text">[HDCTF2019]Maze</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#脱壳"><span class="toc-number">3.</span> <span class="toc-text">脱壳</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#迷宫"><span class="toc-number">3.1.</span> <span class="toc-text">迷宫</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#flag"><span class="toc-number">3.2.</span> <span class="toc-text">flag</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#RoarCTF2019-babyRSA"><span class="toc-number">4.</span> <span class="toc-text">[RoarCTF2019]babyRSA</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#题目"><span class="toc-number">4.1.</span> <span class="toc-text">题目</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#扩充：Wilson定理"><span class="toc-number">4.2.</span> <span class="toc-text">扩充：Wilson定理</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#exp-1"><span class="toc-number">4.3.</span> <span class="toc-text">exp</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#WUSTCTF2020-B-se"><span class="toc-number">5.</span> <span class="toc-text">[WUSTCTF2020]B@se</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#题目-1"><span class="toc-number">5.1.</span> <span class="toc-text">题目</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#exp-2"><span class="toc-number">5.2.</span> <span class="toc-text">exp</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#WUSTCTF2020-dp-leaking-1s-very-d-angerous"><span class="toc-number">6.</span> <span class="toc-text">[WUSTCTF2020]dp_leaking_1s_very_d@angerous</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#样例"><span class="toc-number">6.1.</span> <span class="toc-text">样例</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#exp-3"><span class="toc-number">6.2.</span> <span class="toc-text">exp</span></a></li></ol></li></ol>
                </div>
            </div>
            
            
        </div>
    </div>
</div>

    </div>
</div>
    <div id="back-to-top" class="animated fadeIn faster">
        <div class="flow"></div>
        <span class="percentage animated fadeIn faster">0%</span>
        <span class="iconfont icon-top02 animated fadeIn faster"></span>
    </div>
</body>
<footer>
    <p class="copyright" id="copyright">
		<span id="timeDate">载入天数...</span><span id="times">载入时分秒...</span>
		<script>
		var now = new Date(); 
		function createtime() { 
			var grt= new Date("01/10/2020 00:00:00");//在此处修改你的建站时间
			now.setTime(now.getTime()+250); 
			days = (now - grt ) / 1000 / 60 / 60 / 24; dnum = Math.floor(days); 
			hours = (now - grt ) / 1000 / 60 / 60 - (24 * dnum); hnum = Math.floor(hours); 
			if(String(hnum).length ==1 ){hnum = "0" + hnum;} minutes = (now - grt ) / 1000 /60 - (24 * 60 * dnum) - (60 * hnum); 
			mnum = Math.floor(minutes); if(String(mnum).length ==1 ){mnum = "0" + mnum;} 
			seconds = (now - grt ) / 1000 - (24 * 60 * 60 * dnum) - (60 * 60 * hnum) - (60 * mnum); 
			snum = Math.round(seconds); if(String(snum).length ==1 ){snum = "0" + snum;} 
			document.getElementById("timeDate").innerHTML = "本站已安全运行 "+dnum+" 天 "; 
			document.getElementById("times").innerHTML = hnum + " 小时 " + mnum + " 分 " + snum + " 秒"; 
		} 
		setInterval("createtime()",250);
		</script>
        &copy; 2020
        <span class="gradient-text">
            L3SLIE
        </span>❤
        Powered by <a href="http://hexo.io/" title="Hexo" target="_blank" rel="noopener">Hexo</a>
        Theme
        <span class="gradient-text">
            <a href="https://github.com/TriDiamond/hexo-theme-obsidian" title="Obsidian" target="_blank" rel="noopener">Obsidian</a>
        </span>
        <small><a href="https://github.com/TriDiamond/hexo-theme-obsidian/blob/master/CHANGELOG.md" title="v1.4.3" target="_blank" rel="noopener">v1.4.3</a></small>
    </p>
</footer>

<script type="text/javascript" src="https://cdn.bootcss.com/mathjax/2.7.6/MathJax.js?config=TeX-AMS-MML_HTMLorMML">
</script>
<script>
  MathJax.Hub.Config({
    "HTML-CSS": {
      preferredFont: "TeX",
      availableFonts: ["STIX", "TeX"],
      linebreaks: {
        automatic: true
      },
      EqnChunk: (MathJax.Hub.Browser.isMobile ? 10 : 50)
    },
    tex2jax: {
      inlineMath: [
        ["$", "$"],
        ["\\(", "\\)"]
      ],
      processEscapes: true,
      ignoreClass: "tex2jax_ignore|dno",
      skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
    },
    TeX: {
      noUndefined: {
        attributes: {
          mathcolor: "red",
          mathbackground: "#FFEEEE",
          mathsize: "90%"
        }
      },
      Macros: {
        href: "{}"
      }
    },
    messageStyle: "none"
  });
</script>
<script>
  function initialMathJax() {
    MathJax.Hub.Queue(function () {
      var all = MathJax.Hub.getAllJax(),
        i;
      // console.log(all);
      for (i = 0; i < all.length; i += 1) {
        console.log(all[i].SourceElement().parentNode)
        all[i].SourceElement().parentNode.className += ' has-jax';
      }
    });
  }

  function reprocessMathJax() {
    if (typeof MathJax !== 'undefined') {
      MathJax.Hub.Queue(["Typeset", MathJax.Hub]);
    }
  }
</script>




<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
<script src="/js/plugin.js"></script>
<script src="/js/obsidian.js"></script>
<script src="/js/jquery.truncate.js"></script>
<script src="/js/search.js"></script>


<script src="//cdn.bootcss.com/typed.js/2.0.10/typed.min.js"></script>


<script src="//cdn.bootcss.com/blueimp-md5/2.12.0/js/md5.min.js"></script>


<script src="//cdnjs.cloudflare.com/ajax/libs/social-share.js/1.0.16/js/social-share.min.js"></script>


<script src="https://cdn.bootcss.com/codemirror/5.48.4/codemirror.min.js"></script>

    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/javascript/javascript.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/css/css.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/xml/xml.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/htmlmixed/htmlmixed.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/clike/clike.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/php/php.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/shell/shell.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/python/python.min.js"></script>




    
<script src="/js/busuanzi.min.js"></script>

    <script>
        $(document).ready(function () {
            if ($('span[id^="busuanzi_"]').length) {
                initialBusuanzi();
            }
        });
    </script>



<link rel="stylesheet" href="//cdn.bootcss.com/photoswipe/4.1.3/photoswipe.min.css">
<link rel="stylesheet" href="//cdn.bootcss.com/photoswipe/4.1.3/default-skin/default-skin.min.css">


<script src="//cdn.bootcss.com/photoswipe/4.1.3/photoswipe.min.js"></script>
<script src="//cdn.bootcss.com/photoswipe/4.1.3/photoswipe-ui-default.min.js"></script>


<!-- Root element of PhotoSwipe. Must have class pswp. -->
<div class="pswp" tabindex="-1" role="dialog" aria-hidden="true">
    <!-- Background of PhotoSwipe. 
         It's a separate element as animating opacity is faster than rgba(). -->
    <div class="pswp__bg"></div>
    <!-- Slides wrapper with overflow:hidden. -->
    <div class="pswp__scroll-wrap">
        <!-- Container that holds slides. 
            PhotoSwipe keeps only 3 of them in the DOM to save memory.
            Don't modify these 3 pswp__item elements, data is added later on. -->
        <div class="pswp__container">
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
        </div>
        <!-- Default (PhotoSwipeUI_Default) interface on top of sliding area. Can be changed. -->
        <div class="pswp__ui pswp__ui--hidden">
            <div class="pswp__top-bar">
                <!--  Controls are self-explanatory. Order can be changed. -->
                <div class="pswp__counter"></div>
                <button class="pswp__button pswp__button--close" title="Close (Esc)"></button>
                <button class="pswp__button pswp__button--share" title="Share"></button>
                <button class="pswp__button pswp__button--fs" title="Toggle fullscreen"></button>
                <button class="pswp__button pswp__button--zoom" title="Zoom in/out"></button>
                <!-- Preloader demo http://codepen.io/dimsemenov/pen/yyBWoR -->
                <!-- element will get class pswp__preloader--active when preloader is running -->
                <div class="pswp__preloader">
                    <div class="pswp__preloader__icn">
                      <div class="pswp__preloader__cut">
                        <div class="pswp__preloader__donut"></div>
                      </div>
                    </div>
                </div>
            </div>
            <div class="pswp__share-modal pswp__share-modal--hidden pswp__single-tap">
                <div class="pswp__share-tooltip"></div> 
            </div>
            <button class="pswp__button pswp__button--arrow--left" title="Previous (arrow left)">
            </button>
            <button class="pswp__button pswp__button--arrow--right" title="Next (arrow right)">
            </button>
            <div class="pswp__caption">
                <div class="pswp__caption__center"></div>
            </div>
        </div>
    </div>
</div>







<script>
    function initialTyped () {
        var typedTextEl = $('.typed-text');
        if (typedTextEl && typedTextEl.length > 0) {
            var typed = new Typed('.typed-text', {
                strings: ["Life Long &amp; Pwn", "生命不息，破解不止"],
                typeSpeed: 90,
                loop: true,
                loopCount: Infinity,
                backSpeed: 20,
            });
        }
    }

    if ($('.article-header') && $('.article-header').length) {
        $(document).ready(function () {
            initialTyped();
        });
    }
</script>


    
<script src="//unpkg.com/valine/dist/Valine.min.js"></script>

    <script>

        var valine = new Valine();

        function initValine(path) {
            if (!path) path = window.location.pathname;
            let language = '';
            if (!language) {
                language = 'en';
            } else {
                language = language.toLowerCase();
            }
            valine.init({
                el: '#vcomments',
                appId: 'GnPlbHQ9xAWEoCDC8rR3zALj-gzGzoHsz',
                appKey: 'Nygd2awSxr9ioTDtvbH6hE0l',
                notify: 'false',
                verify: 'false',
                avatar: 'mm',
                placeholder: 'feel free to comment~',
                visitor: 'true',
                path: path,
                lang: language
            });
        }

        $(document).ready(function () {
            initValine();
        });
    </script>



</html>
<!-- 页面点击小红心 -->
<script type="text/javascript" src="/js/love.js"></script>
<!-- 烟火效果 -->
<canvas class="fireworks" style="position: fixed;left: 0;top: 0;z-index: 1; pointer-events: none;" ></canvas> 
<script type="text/javascript" src="//cdn.bootcss.com/animejs/2.2.0/anime.min.js"></script> 
<script type="text/javascript" src="/js/fireworks.js"></script>
<!--自定义标题-->
<script type="text/javascript" src="\js\title.js"></script>
